pattern elf_header 7f454c46
string ls1 invalid suffix in %s%s argument '%s'
string ls2 General help using GNU software: <%s>
string ls3 "List information about the FILEs (the current directory by default).\n"
string foo DSKJFDSALKFJDSAFJDSALKF
string beep alksjfakdsfjsadfjdsalkfj
string evil1 this is a very evil program

rule elf allow elf_header:0
rule evil block elf_header:0 evil1